<html>
<head><meta charset="utf-8"><title>security-related crates · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html">security-related crates</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="136008391"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136008391" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136008391">(Oct 17 2018 at 23:40)</a>:</h4>
<p>Well guess I'll try making my first Zulip topic here... a place to dump info about your security-related crates</p>



<a name="136008452"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136008452" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136008452">(Oct 17 2018 at 23:40)</a>:</h4>
<p>here's another one of mine: subtle-encoding: constant time hex and base64 encoders/decoders: <a href="https://github.com/iqlusioninc/crates/tree/master/subtle-encoding" target="_blank" title="https://github.com/iqlusioninc/crates/tree/master/subtle-encoding">https://github.com/iqlusioninc/crates/tree/master/subtle-encoding</a></p>



<a name="136052510"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136052510" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136052510">(Oct 18 2018 at 15:59)</a>:</h4>
<p>this looks pretty neat <a href="https://github.com/Shnatsel/libdiffuzz" target="_blank" title="https://github.com/Shnatsel/libdiffuzz">https://github.com/Shnatsel/libdiffuzz</a></p>



<a name="136066105"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136066105" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136066105">(Oct 18 2018 at 19:30)</a>:</h4>
<p>Hey! libdiffuzz author here. That thing is kind of a hack to get by without Memory Sanitizer, and will be mostly obsolete in Rust contexts once MSAN works well with Rust (but there are use cases for it elsewhere).<br>
Also, it is a dynamic analysis tool that's only really useful when combined with a fuzzer (just like sanitizers), and does not check the program exhaustively. This is explicitly out of scope of this WG, which is more about verifying unsafe code statically or getting rid of unsafe code entirely.</p>



<a name="136066158"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136066158" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136066158">(Oct 18 2018 at 19:31)</a>:</h4>
<p>As for as security-related crates, <a href="https://crates.io/crates/untrusted" target="_blank" title="https://crates.io/crates/untrusted">https://crates.io/crates/untrusted</a> looks neat. I have never used it, though, so can't say if it's actually good or bad.</p>



<a name="136079498"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136079498" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136079498">(Oct 18 2018 at 23:48)</a>:</h4>
<p>I like what <code>untrusted</code> accomplishes</p>



<a name="136079540"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136079540" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136079540">(Oct 18 2018 at 23:48)</a>:</h4>
<p>although I find it moderately annoying it's part of <em>ring</em>'s public API</p>



<a name="136079543"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136079543" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136079543">(Oct 18 2018 at 23:48)</a>:</h4>
<p>rather than hidden behind the scenes</p>



<a name="136079555"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136079555" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136079555">(Oct 18 2018 at 23:49)</a>:</h4>
<p>I guess that gives the caller more control over allocation... still a bit obtrusive</p>



<a name="136958092"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136958092" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136958092">(Nov 01 2018 at 23:42)</a>:</h4>
<p>here's a crate some of you might find interesting: <a href="https://keychain-services.rs/docs/" target="_blank" title="https://keychain-services.rs/docs/">https://keychain-services.rs/docs/</a></p>



<a name="136958298"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136958298" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136958298">(Nov 01 2018 at 23:46)</a>:</h4>
<p>wrapper around the macOS Security Framework's Keychain Services</p>



<a name="136958309"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/136958309" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#136958309">(Nov 01 2018 at 23:47)</a>:</h4>
<p>gonna try to use this for GPG and git signing</p>



<a name="137080001"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/137080001" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#137080001">(Nov 02 2018 at 20:22)</a>:</h4>
<p>The idea being <code>untrusted</code> is that you are supposed to be able to use it end-to-end without using the <code>as_slice_less_safe()</code> function. That's why it's part of <em>ring</em>'s API.</p>



<a name="137080211"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/137080211" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> briansmith <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#137080211">(Nov 02 2018 at 20:26)</a>:</h4>
<p>In particular, any function that takes an <code>untrusted::Input</code> indicates that it is responsible for parsing and validating those untrusted inputs, so the caller doesn't have to (and in many cases, shouldn't try). This design design works well if one is using <code>untrusted::Input</code> for all parsing but it works less well if one is using it only because <em>ring</em> requires it. For example, it worked very well in my own TLS implementation because I used <code>untrusted</code> to parse TLS records and TLS handshake messages, so everything is already in <code>untrusted::Input</code> form when I hand it to <em>ring</em>.</p>



<a name="182141823"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/182141823" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#182141823">(Nov 28 2019 at 23:49)</a>:</h4>
<p><a href="https://careers.microsoft.com/us/en/job/750306/Security-Software-Engineer" target="_blank" title="https://careers.microsoft.com/us/en/job/750306/Security-Software-Engineer">https://careers.microsoft.com/us/en/job/750306/Security-Software-Engineer</a></p>



<a name="182195516"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/182195516" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#182195516">(Nov 29 2019 at 18:07)</a>:</h4>
<p>talk about zombie threads?^^</p>



<a name="182195547"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/security-related%20crates/near/182195547" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> RalfJ <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/security-related.20crates.html#182195547">(Nov 29 2019 at 18:07)</a>:</h4>
<blockquote>
<p>Additionally, our vulnerability research tools are primarily written in Rust so experience there is a plus.</p>
</blockquote>
<p>cool :D</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>